PowerDNS Recursor 4.3.5, 4.2.5. and 4.1.18 released fixing a cache pollution issue (CVE-2020-25829)

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--===============2560858025626163974==
Content-Type: multipart/signed; micalg=pgp-sha256;
 protocol="application/pgp-signature";
 boundary="WZPFZVr6DSql1hY7Mx2c1ycUnlaGTkBDY"

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--WZPFZVr6DSql1hY7Mx2c1ycUnlaGTkBDY
Content-Type: multipart/mixed; boundary="vt3w5T7b5DGDJWsVQhsmtqj7mIw3meWBK"

--vt3w5T7b5DGDJWsVQhsmtqj7mIw3meWBK
Content-Type: text/plain; charset=utf-8
Content-Language: en-US
Content-Transfer-Encoding: quoted-printable

Hello!,

Today we are releasing PowerDNS Recursor 4.3.5, 4.2.5. and 4.1.18,
containing a security fix for CVE-2020-25829[1]:

An issue has been found in PowerDNS Recursor where a remote attacker
can cause the cached records for a given name to be updated to the
Bogus DNSSEC validation state, instead of their actual DNSSEC Secure
state, via a DNS ANY query. This results in a denial of service for
installations that always validate (dnssec=3Dvalidate) and for clients
requesting validation when on-demand validation is enabled
(dnssec=3Dprocess). The severity is high for these cases.

As usual, there were also other smaller enhancements and
bugfixes. Please refer to the 4.3.5 changelog[2], 4.2.5 changelog[3]
and 4.1.18 changelog[4] for details.

The 4.3.5 tarball[5] (signature[6]), 4.2.5 tarball[7] (signature[8])
and 4.1.18 tarball[9] (signature[10]) are available at our download
site[11] and packages for CentOS 6, 7 and 8, Debian Stretch and
Buster, Ubuntu Xenial and Bionic are available from our
repository[12].

4.0 and older releases are EOL, refer to the documentation[13] for detail=
s
about our release cycles.

Please send us all feedback and issues you might have via the mailing
list[14], or in case of a bug, via GitHub[15].

Regards,

 -Otto and the PowerDNS Team
=20
[1] https://docs.powerdns.com/recursor/security-advisories/powerdns-advis=
ory-2020-07.html
[2] https://doc.powerdns.com/recursor/changelog/4.3.html#change-4.3.5
[3] https://doc.powerdns.com/recursor/changelog/4.2.html#change-4.2.5
[4] https://doc.powerdns.com/recursor/changelog/4.1.html#change-4.1.18
[5] https://downloads.powerdns.com/releases/pdns-recursor-4.3.5.tar.bz2
[6] https://downloads.powerdns.com/releases/pdns-recursor-4.3.5.tar.bz2.s=
ig
[7] https://downloads.powerdns.com/releases/pdns-recursor-4.2.5.tar.bz2
[8] https://downloads.powerdns.com/releases/pdns-recursor-4.2.5.tar.bz2.s=
ig
[9] https://downloads.powerdns.com/releases/pdns-recursor-4.1.18.tar.bz2
[10] https://downloads.powerdns.com/releases/pdns-recursor-4.1.18.tar.bz2=
=2Esig
[11] https://downloads.powerdns.com/releases/
[12] https://repo.powerdns.com/
[13] https://docs.powerdns.com/recursor/appendices/EOL.html
[14] https://mailman.powerdns.com/mailman/listinfo/pdns-users
[15] https://github.com/PowerDNS/pdns/issues/new/choose

--=20
kind regards,
Otto Moerbeek
Senior PowerDNS Developer

Email: [email protected]




--vt3w5T7b5DGDJWsVQhsmtqj7mIw3meWBK--

--WZPFZVr6DSql1hY7Mx2c1ycUnlaGTkBDY
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQEzBAEBCAAdFiEEmQw9Dqx8J13GsYQ26sq5Cxlj7CsFAl+Fi3IACgkQ6sq5Cxlj
7CsbdAf/dk01kko3vZDUm/wCPPmLG9jwPVGfR/R56iMcBJ7MAJ2IMFccVPawFZzt
/FgE+R7NRlXHnUA0FvSRdLH+AiXmFaBCHfYtFqNnoWhvYc6/MnkWhN6BUZro+unJ
x52kray3PGn1VAsMrGuSkedKFIIuXxdWbOgMkzxfP4uPN0p0uJeKigi2Nly/VI9+
9h9S90qE/tpBi5DqwLNqDUktZ7N3jVlowZ320C5gklppIuonHBUoxhqsi+j5DpMZ
YYCQ7OMB+OydvWgCd3Ue2FN47WR6kumoAbcJicFxC2e6V+27+U9ufhMZfn7ns02K
bXg+aj+3EfMRxXAywaCcXyk6jOVq/g==
=dU+w
-----END PGP SIGNATURE-----

--WZPFZVr6DSql1hY7Mx2c1ycUnlaGTkBDY--

--===============2560858025626163974==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Pdns-dev mailing list
[email protected]
https://mailman.powerdns.com/mailman/listinfo/pdns-dev

--===============2560858025626163974==--